netdev - Re: Repeatable inet6_dump_fib crash in stock 4.12.0-rc4+

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 8 Jun 2017 22:55:47 -0700
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     Ben Greear <greearb@...delatech.com>
Cc:     Eric Dumazet <eric.dumazet@...il.com>,
        David Ahern <dsahern@...il.com>,
        netdev <netdev@...r.kernel.org>
Subject: Re: Repeatable inet6_dump_fib crash in stock 4.12.0-rc4+

On Thu, Jun 8, 2017 at 2:27 PM, Ben Greear <greearb@...delatech.com> wrote:
>
> As far as I can tell, the patch did not help, or at least we still reproduce
> the
> crash easily.

netlink dump is serialized by nlk->cb_mutex so I don't think that
patch makes any sense w.r.t race condition.


> (gdb) l *(fib6_walk_continue+0x76)
> 0x188c6 is in fib6_walk_continue
> (/home/greearb/git/linux-2.6/net/ipv6/ip6_fib.c:1593).
> 1588                            if (fn == w->root)
> 1589                                    return 0;
> 1590                            pn = fn->parent;
> 1591                            w->node = pn;
> 1592    #ifdef CONFIG_IPV6_SUBTREES
> 1593                            if (FIB6_SUBTREE(pn) == fn) {

Apparently fn->parent is NULL here for some reason, but
I don't know if that is expected or not. If a simple NULL check
is not enough here, we have to trace why it is NULL.


> 1594                                    WARN_ON(!(fn->fn_flags & RTN_ROOT));
> 1595                                    w->state = FWS_L;
> 1596                                    continue;
> 1597                            }
> (gdb) l *(inet6_dump_fib+0x1ab)
> 0x1939b is in inet6_dump_fib
> (/home/greearb/git/linux-2.6/net/ipv6/ip6_fib.c:392).
> 387                             w->skip = w->count;
> 388                     } else
> 389                             w->skip = 0;
> 390
> 391                     res = fib6_walk_continue(w);
> 392                     read_unlock_bh(&table->tb6_lock);
> 393                     if (res <= 0) {
> 394                             fib6_walker_unlink(net, w);
> 395                             cb->args[4] = 0;
> 396                     }
> (gdb)


Thanks.